HashiCorp Vault Associate (003) Question 153
Single answer5f Explain the value of short-lived, dynamically generated secretsA company currently stores a shared database username and password in a CI/CD pipeline so application deployments can run schema checks. The security team wants to reduce the risk of credential leakage and limit the impact if a pipeline log accidentally exposes credentials. They are evaluating HashiCorp Vault's database secrets engine to issue credentials to the pipeline at runtime. Which benefit best explains the value of using short-lived, dynamically generated secrets in this scenario?
- A
Vault can generate unique database credentials on demand with a lease and TTL, so exposed credentials expire automatically and are not long-lived shared secrets.
- B
Vault encrypts the database traffic between the pipeline and the database, removing the need to manage database credentials.
- C
Vault stores the existing static database password in KV so the pipeline can reuse it securely without changing the application workflow.
- D
Vault creates one permanent database account per pipeline job, which improves auditability because the same credentials can be reused for future runs.
Show answer and explanation
Correct answer: A
Explanation
HashiCorp Vault's dynamic secrets model is designed to reduce the risks associated with static, shared credentials. For supported systems such as databases, Vault can generate credentials on demand and return them with a lease. Those credentials are short-lived, can expire automatically based on TTL, and can be revoked early if needed. In practice, this limits the blast radius of leaked credentials, reduces secret reuse, and improves operational security for workflows like CI/CD pipelines, ephemeral workloads, and temporary application sessions. This aligns with Vault documentation and best practices around dynamic secrets, leases, TTLs, and revocation: instead of distributing long-lived passwords broadly, clients obtain secrets just in time and use them only for the duration needed.
- A. Correct.
Correct. This is the core value of short-lived, dynamically generated secrets in Vault. With the database secrets engine, Vault can create credentials on demand and associate them with a lease and time-to-live (TTL). If those credentials are exposed in logs or otherwise leaked, their usefulness is limited because they expire automatically and can also be revoked. This reduces reliance on shared, long-lived credentials and shrinks the window of exposure.
- B. Incorrect.
Incorrect. Vault's dynamic secrets do not inherently encrypt network traffic between the client and the database. Transport security is typically handled separately with TLS or database-native encryption settings. The main benefit here is just-in-time credential generation, leasing, expiration, and revocation, not replacement of secure transport controls.
- C. Incorrect.
Incorrect. Storing a static password in the KV secrets engine may centralize secret storage, but it does not provide the primary benefit of short-lived, dynamically generated secrets. The password would still be a long-lived shared credential unless rotated manually or by another process. This does not significantly reduce the blast radius of leaked credentials compared with dynamic database credentials.
- D. Incorrect.
Incorrect. Dynamic secrets are valuable precisely because they are not permanent credentials intended for reuse. Creating a permanent account for each pipeline job would increase credential sprawl and administrative burden. Auditability improves because Vault can issue unique ephemeral credentials per use, but those credentials should expire or be revoked rather than persist for future runs.